Device-independent user authentication

Abstract

In some implementations, a device may receive, from a user device, a login request to access an account associated with a user. The device may determine device metadata relating to a use of the user device in connection with the login request. The device may determine whether the use is recognized for the user based on the device metadata. The device may cause, responsive to a determination that the use is not recognized for the user, the user device to provide a prompt for inputting a handwriting sample. The device may determine input metadata relating to an inputting of the handwriting sample. The device may determine whether the handwriting sample is valid for the user based on the input metadata and an image of the handwriting sample. The device may authorize the login request responsive to a determination that the handwriting sample is valid for the user.

What is claimed is: 
     
         1 . A system for device-independent user authentication, the system comprising:
 one or more memories; and   one or more processors, communicatively coupled to the one or more memories, configured to:
 receive, from a user device, a login request to access an account associated with a user; 
 determine device metadata relating to a use of the user device in connection with the login request,
 wherein the device metadata includes one or more of: an orientation of the user device, a touch pressure of inputs to the user device, or a typing speed on the user device; 
 
 determine, using a first user-specific machine learning model, whether the use is recognized for the user based on the device metadata; 
 cause, responsive to a determination that the use is not recognized for the user, the user device to provide a prompt for inputting a handwriting sample; 
 determine input metadata relating to an inputting of the handwriting sample,
 wherein the input metadata includes one or more of: an input pressure used for the handwriting sample or an input speed used for the handwriting sample; 
 
 determine, using a second user-specific machine learning model, whether the handwriting sample is valid for the user based on the input metadata and an image of the handwriting sample; and 
 authorize the login request responsive to a determination that the handwriting sample is valid for the user. 
   
     
     
         2 . The system of  claim 1 , wherein the handwriting sample is a signature sample. 
     
     
         3 . The system of  claim 1 , wherein the one or more processors are further configured to:
 identify that a quantity of handwriting samples provided by the user satisfies a threshold;   deactivate, responsive to the quantity of handwriting samples satisfying the threshold, a non-user-specific machine learning model for assessments of whether handwriting samples are valid for the user; and   activate, responsive to the quantity of handwriting samples satisfying the threshold, the second user-specific machine learning model for assessments of whether handwriting samples are valid for the user.   
     
     
         4 . The system of  claim 1 , wherein the one or more processors, to authorize the login request, are configured to:
 generate a session token for the user device;   cause a cookie to be set on the user device; or   cause the user device to load a document relating to the account.   
     
     
         5 . The system of  claim 1 , wherein the one or more processors, to determine the device metadata, are configured to:
 obtain, from the user device, at least one of touch data or inertial measurement data; and   determine the device metadata based on the at least one of the touch data or the inertial measurement data.   
     
     
         6 . The system of  claim 1 , wherein the one or more processors, to determine the input metadata, are configured to:
 obtain, from the user device, touch data; and   determine the input metadata based on the touch data.   
     
     
         7 . The system of  claim 1 , wherein the first user-specific machine learning model is trained using training data that relates to another user device. 
     
     
         8 . The system of  claim 1 , wherein the first user-specific machine learning model is trained to identify an anomalous use of the user device based on an input of the device metadata. 
     
     
         9 . The system of  claim 1 , wherein the second user-specific machine learning model is trained to identify an anomalous handwriting sample based on an input of the input metadata. 
     
     
         10 . A method of device-independent user authentication, comprising:
 receiving, by a device and from a user device, a login request to access an account associated with a user;   determining device metadata relating to a use of the user device in connection with the login request;   determining whether the use is recognized for the user based on the device metadata;   causing, responsive to a determination that the use is not recognized for the user, the user device to provide a prompt for inputting a handwriting sample;   determining input metadata relating to an inputting of the handwriting sample;   determining whether the handwriting sample is valid for the user based on the input metadata and an image of the handwriting sample; and   authorizing the login request responsive to a determination that the handwriting sample is valid for the user.   
     
     
         11 . The method of  claim 10 , wherein the device metadata includes one or more of: an orientation of the user device, a touch pressure of inputs to the user device, or a typing speed on the user device. 
     
     
         12 . The method of  claim 11 , wherein the device metadata further includes one or more of:
 an address that identifies the user device,   a time of the login request, or   a geographic location of the user device at the time of the login request.   
     
     
         13 . The method of  claim 10 , wherein the input metadata includes one or more of: an input pressure used for the handwriting sample or an input speed used for the handwriting sample. 
     
     
         14 . The method of  claim 10 , wherein the login request indicates an authentication code sent to the user device. 
     
     
         15 . The method of  claim 10 , wherein determining whether the use is recognized for the user is determined using a first user-specific machine learning model, and
 wherein determining whether the handwriting sample is valid for the user is determined using a second user-specific machine learning model.   
     
     
         16 . The method of  claim 10 , further comprising:
 causing, responsive to the determination that the handwriting sample is valid for the user, an authentication code to be sent to a telephone number associated with the user; and   receiving an additional login request that indicates the authentication code,
 wherein authorizing the login request comprises authorizing the login request responsive to the determination that the handwriting sample is valid for the user and responsive to the additional login request indicating the authentication code. 
   
     
     
         17 . A non-transitory computer-readable medium storing a set of instructions for device-independent user authentication, the set of instructions comprising:
 one or more instructions that, when executed by one or more processors of a device, cause the device to:
 determine device metadata relating to a use of a user device; 
 determine whether the use is recognized based on the device metadata; 
 cause, responsive to a determination that the use is not recognized, the user device to provide a prompt for inputting a handwriting sample; 
 determine input metadata relating to an inputting of the handwriting sample; and 
 determine whether the handwriting sample is valid based on the input metadata and an image of the handwriting sample. 
   
     
     
         18 . The non-transitory computer-readable medium of  claim 17 , wherein the one or more instructions, when executed by the one or more processors, further cause the device to:
 receive, from the user device, an initial login request to access an account;   cause, responsive to the initial login request, an authentication code to be sent to a telephone number associated with the account; and   receive, from the user device, a login request to access the account,
 wherein the login request indicates the authentication code. 
   
     
     
         19 . The non-transitory computer-readable medium of  claim 17 , wherein the one or more instructions, when executed by the one or more processors, further cause, responsive to a determination that the handwriting sample is valid, the device to:
 generate a session token for the user device;   cause a cookie to be set on the user device; or   cause the user device to load a document relating to an account.   
     
     
         20 . The non-transitory computer-readable medium of  claim 17 , wherein the device metadata includes one or more of: an orientation of the user device, a touch pressure of inputs to the user device, or a typing speed on the user device, and
 wherein the input metadata includes one or more of: an input pressure used for the handwriting sample or an input speed used for the handwriting sample.